How Twitter Made a Hash of Passwords
By Duane Thresher, Ph.D.
May 4, 2018
Yesterday it was reported that Twitter user passwords may have
been exposed, at least to Twitter employees, which may be a
bigger security risk than you think, and any Twitter hackers.
The descriptions of the technical aspects of this story in the
media have been awful, to say the least. Here
is the best description, one boiled down to its understandable
essentials, from an actual IT
When you are at your computer or smartphone and want to log in
to Twitter you enter your password into the browser or app.
(Probably you have your computer or smartphone remember the
password for you but that is not important here.)
To allow you to log in, Twitter then has to compare this
password with the correct password on file with Twitter. By
"on file" I mean in a file on a Twitter hard drive. But if
this correct password is on file with Twitter that means
Twitter employees, or any Twitter hackers, can read this
password, which should not be the case. So how is this
Nothing to do with the hash tags Twitter uses. Hashing is a
method to encrypt the password, but without a password to do
this encryption, since otherwise you would still have the same
problem, only one level higher.
Hashing changes the relatively-short variable-length password
into a long fixed-length unique character string, a hash, such
that it is practically impossible to reverse the process and
figure out the password from the hash. The same password will
always produce the same hash and no other password will
produce that hash.
Then the hash, instead of the password itself, can be saved on
file at Twitter and no one, not Twitter employee or hacker,
can figure out the password.
To see if a user-entered password is correct, Twitter need
only hash this user-entered password and compare the resulting
hash to the hash on file at Twitter. (And a user, or hacker,
can't just enter the hash instead of the
Only if it is implemented correctly. And business, including
the media, and government is full of the IT incompetent,
First, the user-entered password must be encrypted at the
computer or smartphone before it is sent to Twitter so that
even if it is intercepted it can not be read. This can be
done via secure http, i.e., https.
Once this user-entered password reaches Twitter and is
decrypted it must be hashed for comparison to the hash on
file. This is where IT incompetent Twitter made a hash of
things. (I used to use Twitter and as someone who has
programmed extensively, I can confirm that it is badly
programmed in several other ways.)
The password should never be on file. That is the whole point
of hashing. It should be hashed while it is in memory (RAM)
and then cleared from memory. Apparently though, Twitter
instead stupidly kept the password in log files that were not
immediately deleted, if ever. That is one of the stupidest
mistakes that could be made. Twitter really made a huge hash
Your computer operating system probably keeps a password hash
file. In early Microsoft Windows versions the hashing was
actually relatively easily reversible and hackers would just
steal the hash file and decrypt it at their computers to get
the passwords at their leisure. Twitter's mistake was far
more stupid than that though.
The implications of Twitter's stupid mistake are huge. Since
President Trump uses Twitter a lot, it is a national security
risk. Read Trump
Using Twitter is a National Security Risk